We, the residents of Europe
The GDPR applies to both organizations and the personal data they process. Therefore, all concerned persons whose personal data is processed are protected by the GDPR, regardless of nationality or country of residence. However, European residents are concerned on several levels.
Find out more about the rights granted to individuals, whether European or not
However, processing performed outside the European Union, for example, on the servers of an American parent company, will also be subject to the GDPR if it is related to the activities of the European entity.
For example, employee performance evaluations used by an entity to assess promotions or processing relating to targeted advertising used to market an entity.
If the entity is one among a group of companies, the GDPR rules are adapted: a DPO may be appointed for the entire group.
We, the companies of the world
The GDPR is groundbreaking because its scope is extraterritorial: it potentially applies to organizations worldwide.
For instance, if a company outside the European Union targets consumers in the European Union to sell their goods or services, the GDPR applies to processing these consumers’ data. However, the data must specifically relate to EU residents for the GDPR to apply.
Case law will specify the criteria for targeting European consumers. Criteria may involve the language used, the country of delivery, and the currency used.
This extraterritoriality highlights the importance of personal data protection for European legislators, who seek to prevent foreign companies from sidestepping the GDPR.
To facilitate relations between the European data protection authorities and foreign companies subject to the GDPR, the latter must designate a representative in the European Union.
We are now able to answer the question, “who is concerned by the GDPR”:
- All European citizens whose personal data is processed
- Entities in the European Union must ensure the ethical processing and security of the personal data
- Foreign entities offering products or services to European residents